{"id":"CVE-2026-114492","kind":"vulnerability","aliases":["CVE-2026-114492"],"related":[],"title":"gin-vue-admin: path traversal in removePlugin lets admins delete directories","description":"gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../' sequences, causing os.RemoveAll to delete any directory writable by the server process.","summary":"gin-vue-admin through 2.9.2 does not sanitize the pluginName parameter sent to /autoCode/removePlugin, so traversal sequences reach os.RemoveAll. An authenticated administrator can recursively delete any directory the server process can write to.","severity":"high","cvss":7.0,"epss":0.00419,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gin-vue-admin","go","package","self-hosted"],"not_affected_if":["auth-required","no-admin-accounts-exposed"],"how_to_check":"- Check the installed gin-vue-admin version and compare it against `2.9.2`\n- Confirm whether the `/autoCode/removePlugin` route is reachable on your deployment\n- unknown whether the sources list other checks","fix":"- Upgrade gin-vue-admin past `2.9.2` once a patched release is published (sources do not name a fixed version)\n- Until then, restrict access to the autoCode routes to trusted administrators only","status":"open","published_at":"2026-10-21T18:17:27+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:37:04+00:00","updated_at":"2026-10-25T03:37:04+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:37:04Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade gin-vue-admin past `2.9.2` once a patched release is published (sources do not name a fixed version)\n- Until then, restrict access to the autoCode routes to trusted administrators only","reach":"network","title":"gin-vue-admin: path traversal in removePlugin lets admins delete directories","impact":"high","summary":"gin-vue-admin through 2.9.2 does not sanitize the pluginName parameter sent to /autoCode/removePlugin, so traversal sequences reach os.RemoveAll. An authenticated administrator can recursively delete any directory the server process can write to.","category":"package","nicknames":[],"who_cares":["gin-vue-admin","go","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Authenticated admin recursively deletes arbitrary server directories, causing data loss","analyst_note":"Find the patched gin-vue-admin release and the fixed version number at the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-114492 or the project's GitHub advisories.","how_to_check":"- Check the installed gin-vue-admin version and compare it against `2.9.2`\n- Confirm whether the `/autoCode/removePlugin` route is reachable on your deployment\n- unknown whether the sources list other checks","needs_analyst":true,"not_affected_if":["auth-required","no-admin-accounts-exposed"],"who_is_affected":"Teams running gin-vue-admin 2.9.2 or earlier with administrator accounts that can call the autoCode plugin endpoints. The flaw needs an authenticated administrator, so deployments where only trusted staff hold admin accounts carry less risk. unknown whether other versions or configurations are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000661,"input_tokens":3386,"output_tokens":645,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114492':15A,18A '-2026':14A,17A '/autocode/removeplugin':42B,97C '2.9.2':33B,66C 'admin':4A,10A,22B,31B,64C 'administr':50B,75C 'allow':73C 'arbitrari':79C 'attack':89C 'authent':49B,74C 'caus':100C 'contain':67C 'craft':93C 'cve':13A,16A 'delet':11A,53B,78C,103C 'directori':12A,55B,80C,105C 'gin':2A,20B,29B,62C 'gin-vue-admin':1A,19B,28B,61C 'go':23B 'host':27B 'let':9A 'os.removeall':47B,101C 'packag':24B 'paramet':39B,88C 'path':5A,69C 'pluginnam':38B,87C 'post':94C 'process':58B,110C 'reach':46B 'recurs':52B,77C 'removeplugin':8A 'request':95C 'sanit':36B 'self':26B 'self-host':25B 'send':91C 'sent':40B 'sequenc':45B,84C,99C 'server':57B,109C 'suppli':82C 'travers':6A,44B,70C,83C 'vue':3A,21B,30B,63C 'vulner':71C 'writabl':106C 'write':60B","nicknames":[],"mitigations":[],"who_affected":"Teams running gin-vue-admin 2.9.2 or earlier with administrator accounts that can call the autoCode plugin endpoints. The flaw needs an authenticated administrator, so deployments where only trusted staff hold admin accounts carry less risk. unknown whether other versions or configurations are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T18:17:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114492","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114492","severity":null,"published_at":"2026-10-21T18:17:27+00:00","modified_at":"2026-10-23T15:17:26+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114492","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114492","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}